Storage Proofs

Summary

The MAX_V2_DURATION constant in the ScrvusdOracle contract is defined as 4 * 12 * 4 = 192 weeks with a comment indicating "4 years," but 192 weeks is actually closer to 3.69 years, creating a documentation/code inconsistency.

Vulnerability Details

In the ScrvusdOracle contract, the MAX_V2_DURATION constant is defined as:

The calculation yields 192, which is commented as "4 years". If each period is a week (as suggested by the default profit_max_unlock_time of 7 days), then 192 weeks is approximately 3.69 years, not 4 years.

Meanwhile, also the constructor initializes:

This is indeed 24 weeks, which is approximately half a year.

• Given that one period is one week, exactly 4 years should be calculated as (4 * 13 * 4 = 208 weeks). In the provided code, the constant is set to (4 * 12 * 4 = 192 weeks), which is appr. to 3.7 years. Therefore, if the intended duration is truly 4 years, the constant should be updated to 208 weeks, or the comment should be adjusted to reflect that 192 weeks is used (about 3.7 years).

Impact

The likelihood of this causing problems is low, but if the intention of the protocol was to make use of 4years as the documentation included, then theres very high possibility of very severe disruption

Tools Used

Manual Review

Recommendations

Adjust the CONSTANT to match the 4-year intent or explicitly document the 3.7 year duration.